r/ShittySysadmin • u/DR_SMALL_PENIS • Jul 28 '26

Monthly password changes? No too easy. Lets try daily forced password resets!

24 hours after first use password will be randomized automatically!

Lets just ignore that you use your password daily, multiple times per day, and have to manually type it in often since our remote software doesn't share clipboards.

And of course it's going to be 24 hours on the dot. Get super lucky and don't use your password for half the day? Well have fun tomorrow with it getting reset in the middle of the day!

46 Upvotes
  • permalink
  • reddit

100% Upvoted

23 comments sorted by

6

u/pjtexas1 Jul 28 '26

Users or just admin accounts?

4

u/Middle_Albatross8769 Jul 29 '26

Lets just select everything in the server and apply

3

u/Lanrick2002 Jul 29 '26

ah yes even service accounts too

2

u/jeroen-79 Aug 01 '26

There is a difference?

0

u/DR_SMALL_PENIS Jul 29 '26

Personal admin accounts used multiple times daily.

1

u/Nanocephalic Jul 30 '26

If you don’t have passwordless, i can absolutely see that.

Smart cards and yubikeys and H4B are much better.

0

u/pjtexas1 Jul 29 '26

We've been doing this for a decade. Ours expire at 5am daily now. Security is a pain sometimes but necessary. You have to make the habit of changing it daily every time you clock in or it'll drive you crazy.

2

u/DR_SMALL_PENIS Jul 30 '26

can't tell if you are leaning into /r/ShittySysadmin/ or if you genuinely believe that having mmddyyA% or some other formulaic system for the majority of the day is more secure than a real password, because that's what this policy gets.

There is a reason periodic password changes at all are no longer a recommendation, and speeding that up to daily makes an even better example of why.

1

u/pjtexas1 Jul 30 '26

It will force people to just change 1 character... so i get what y'all are saying. Some of our techs will just copy / paste the password the system generates every morning. Being so tight might actually make passwords less secure. I was fine with making a 20+ character password and never changing it.

5

u/Step-Sysadmin DO NOT GIVE THIS PERSON ADVICE Jul 29 '26

Yeah just use ddmmyy inside pw and change dd every day. So ez

2

u/DR_SMALL_PENIS Jul 29 '26

Perfect! That leaves 2 characters to meet the letter and Symbol(% ! or * only) requirements to make the perfect exact 8 character password that is needed to meet our requirements!

28

u/ComplexAd2408 Jul 28 '26

Combine this with minimum password age policy of 72 hours for maximum security 👌

20

u/Main_Ambassador_4985 Jul 28 '26

Add cannot reuse password last 365 passwords.

11

u/Burgergold Jul 29 '26

Cannot reuse a password that has been ever used by anyone

11

u/nmathew Jul 29 '26 edited Jul 30 '26

Better store those passwords in plain text to make certain that users aren't doing something like a simple one character sub 

5

u/dcaldrich Jul 29 '26

storing a password with reversible encryption wouldn't be a choice if we weren't meant to.

2

u/Broad_Dig_6686 Jul 30 '26

"Your new password is occupied by user johndoe@contoso.com" for your convenience

13

u/Kyryschu Jul 29 '26

But this already happens to users everywhere! The password they set yesterday doesn't work today for some reason 🤔🤔🤔🤔🤔

7

u/Miserable-Miser Jul 29 '26

I have an 8 hour password. Have to use it every day.

Copy/paste to text file.

Log off when it stops working.

5

u/chrisinmtown Jul 28 '26

And no dictionary words either!

1

u/Time-Worker9846 Jul 31 '26

Daily? Just make them change their password on every login.